Python 进行数字取证调查

<pre class="brush:php;toolbar:false;">reg query "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionNetworkListSignaturesUnmanaged" /s

<pre class="brush:php;toolbar:false;">#coding=utf-8from winreg import *# 将REG_BINARY值转换成一个实际的Mac地址def val2addr(val):    addr = ""    for ch in val:        addr += ("%02x " % ord(ch))    addr = addr.strip(" ").replace(" ", ":")[0:17]    return addr# 打印网络相关信息def printNets():    net = "/HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows NT/CurrentVersion/NetworkList/Signatures/Unmanaged"    key = OpenKey(HKEY_LOCAL_MACHINE, net)    for i in range(100):        try:            guid = EnumKey(key, i)            netKey = OpenKey(key, str(guid))            (n, addr, t) = EnumValue(netKey, 5)            (n, name, t) = EnumValue(netKey, 4)            macAddr = val2addr(addr)            netName = name            print('[+] ' + netName + '  ' + macAddr)            CloseKey(netKey)        except:            breakif __name__ == "__main__":    printNets()

<pre class="brush:php;toolbar:false;">#!/usr/bin/python#coding=utf-8from _winreg import *import mechanizeimport urllibimport reimport urlparseimport osimport optparse# 将REG_BINARY值转换成一个实际的Mac地址def val2addr(val):    addr = ""    for ch in val:        addr += ("%02x " % ord(ch))    addr = addr.strip(" ").replace(" ", ":")[0:17]    return addr# 打印网络相关信息def printNets(username, password):    net = "SOFTWAREMicrosoftWindows NTCurrentVersionNetworkListSignaturesUnmanaged"    key = OpenKey(HKEY_LOCAL_MACHINE, net)    print "
[*]Networks You have Joined."    for i in range(100):        try:            guid = EnumKey(key, i)            netKey = OpenKey(key, str(guid))            (n, addr, t) = EnumValue(netKey, 5)            (n, name, t) = EnumValue(netKey, 4)            macAddr = val2addr(addr)            netName = name            print '[+] ' + netName + '  ' + macAddr            wiglePrint(username, password, macAddr)            CloseKey(netKey)        except:            break# 通过wigle查找Mac地址对应的经纬度def wiglePrint(username, password, netid):    browser = mechanize.Browser()    browser.open('http://wigle.net')    reqData = urllib.urlencode({'credential_0': username, 'credential_1': password})    browser.open('https://wigle.net/gps/gps/main/login', reqData)    params = {}    params['netid'] = netid    reqParams = urllib.urlencode(params)    respURL = 'http://wigle.net/gps/gps/main/confirmquery/'    resp = browser.open(respURL, reqParams).read()    mapLat = 'N/A'    mapLon = 'N/A'    rLat = re.findall(r'maplat=.*&', resp)    if rLat:        mapLat = rLat[0].split('&')[0].split('=')[1]    rLon = re.findall(r'maplon=.*&', resp)    if rLon:        mapLon = rLon[0].split    print '[-] Lat: ' + mapLat + ', Lon: ' + mapLondef main():    parser = optparse.OptionParser('usage %prog ' + '-u <wigle username> -p <wigle password>')    parser.add_option('-u', dest='username', type='string', help='specify wigle password')    parser.add_option('-p', dest='password', type='string', help='specify wigle username')    (options, args) = parser.parse_args()    username = options.username    password = options.password    if username == None or password == None:        print parser.usage        exit(0)    else:        printNets(username, password)if __name__ == '__main__':    main()

<pre class="brush:php;toolbar:false;">#!/usr/bin/python#coding=utf-8import os# 逐一测试回收站的目录是否存在，并返回第一个找到的回收站目录def returnDir():    dirs=['C:\Recycler\', 'C:\Recycled\', 'C:\$Recycle.Bin\']    for recycleDir in dirs:        if os.path.isdir(recycleDir):            return recycleDir    return None

<pre class="brush:php;toolbar:false;">reg query "HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows NTCurrentVersionProfileListS-1-5-21-2595130515-3345905091-1839164762-1000" /s

<pre class="brush:php;toolbar:false;">#!/usr/bin/python#coding=utf-8import osimport optparsefrom _winreg import *# 逐一测试回收站的目录是否存在，并返回第一个找到的回收站目录def returnDir():    dirs=['C:\Recycler\', 'C:\Recycled\', 'C:\$Recycle.Bin\']    for recycleDir in dirs:        if os.path.isdir(recycleDir):            return recycleDir    return None# 操作注册表来获取相应目录属主的用户名def sid2user(sid):    try:        key = OpenKey(HKEY_LOCAL_MACHINE, "SOFTWAREMicrosoftWindows NTCurrentVersionProfileList" + '\' + sid)        (value, type) = QueryValueEx(key, 'ProfileImagePath')        user = value.split('\')[-1]        return user    except:        return siddef findRecycled(recycleDir):    dirList = os.listdir(recycleDir)    for sid in dirList:        files = os.listdir(recycleDir + sid)        user = sid2user(sid)        print '
[*] Listing Files For User: ' + str(user)        for file in files:            print '[+] Found File: ' + str(file)def main():    recycledDir = returnDir()    findRecycled(recycledDir)if __name__ == '__main__':    main()

<pre class="brush:php;toolbar:false;">#!/usr/bin/python#coding=utf-8import pyPdfimport optparsefrom pyPdf import PdfFileReader# 使用getDocumentInfo()函数提取PDF文档所有的元数据def printMeta(fileName):    pdfFile = PdfFileReader(file(fileName, 'rb'))    docInfo = pdfFile.getDocumentInfo()    print "[*] PDF MeataData For: " + str(fileName)    for meraItem in docInfo:        print "[+] " + meraItem + ": " + docInfo[meraItem]def main():    parser = optparse.OptionParser("[*]Usage: python pdfread.py -F <PDF file name>")    parser.add_option('-F', dest='fileName', type='string', help='specify PDF file name')    (options, args) = parser.parse_args()    fileName = options.fileName    if fileName == None:        print parser.usage        exit(0)    else:        printMeta(fileName)if __name__ == '__main__':    main()

<pre class="brush:php;toolbar:false;">import urllib2from bs4 import BeautifulSoup as BSfrom os.path import basenamefrom urlparse import urlsplit# 通过BeautifulSoup查找URL中所有的img标签def findImages(url):    print '[+] Finding images on ' + url    urlContent = urllib2.urlopen(url).read()    soup = BS(urlContent, 'lxml')    imgTags = soup.findAll('img')    return imgTags# 通过img标签的src属性的值来获取图片URL下载图片def downloadImage(imgTag):    try:        print '[+] Dowloading image...'        imgSrc = imgTag['src']        imgContent = urllib2.urlopen(imgSrc).read()        imgFileName = basename(urlsplit(imgSrc)[2])        imgFile = open(imgFileName, 'wb')        imgFile.write(imgContent)        imgFile.close()        return imgFileName    except:        return ' '

<pre class="brush:php;toolbar:false;">#!/usr/bin/python#coding=utf-8import optparsefrom PIL import Imagefrom PIL.ExifTags import TAGSimport urllib2from bs4 import BeautifulSoup as BSfrom os.path import basenamefrom urlparse import urlsplit# 通过BeautifulSoup查找URL中所有的img标签def findImages(url):    print '[+] Finding images on ' + url    urlContent = urllib2.urlopen(url).read()    soup = BS(urlContent, 'lxml')    imgTags = soup.findAll('img')    return imgTags# 通过img标签的src属性的值来获取图片URL下载图片def downloadImage(imgTag):    try:        print '[+] Dowloading image...'        imgSrc = imgTag['src']        imgContent = urllib2.urlopen(imgSrc).read()        imgFileName = basename(urlsplit(imgSrc)[2])        imgFile = open(imgFileName, 'wb')        imgFile.write(imgContent)        imgFile.close()        return imgFileName    except:        return ' '# 获取图像文件的元数据，并寻找是否存在Exif标签“GPSInfo”def testForExif(imgFileName):    try:        exifData = {}        imgFile = Image.open(imgFileName)        info = imgFile._getexif()        if info:            for (tag, value) in info.items():                decoded = TAGS.get(tag, tag)                exifData[decoded] = value            exifGPS = exifData['GPSInfo']            if exifGPS:                print '[*] ' + imgFileName + ' contains GPS MetaData'    except:        passdef main():    parser = optparse.OptionParser('[*]Usage: python Exif.py -u <target url>')    parser.add_option('-u', dest='url', type='string', help='specify url address')    (options, args) = parser.parse_args()    url = options.url    if url == None:        print parser.usage        exit(0)    else:        imgTags = findImages(url)        for imgTag in imgTags:            imgFileName = downloadImage(imgTag)            testForExif(imgFileName)if __name__ == '__main__':    main()

<pre class="brush:php;toolbar:false;">#!/usr/bin/python#coding=utf-8import sqlite3import optparseimport os# 连接main.db数据库，申请游标，执行SQL语句并返回结果def printProfile(skypeDB):    conn = sqlite3.connect(skypeDB)    c = conn.cursor()    c.execute("SELECT fullname, skypename, city, country, datetime(profile_timestamp,'unixepoch') FROM Accounts;")    for row in c:        print '[*] -- Found Account --'        print '[+] User           : '+str(row[0])        print '[+] Skype Username : '+str(row[1])        print '[+] Location       : '+str(row[2])+','+str(row[3])        print '[+] Profile Date   : '+str(row[4])# 获取联系人的相关信息def printContacts(skypeDB):    conn = sqlite3.connect(skypeDB)    c = conn.cursor()    c.execute("SELECT displayname, skypename, city, country, phone_mobile, birthday FROM Contacts;")    for row in c:        print '
[*] -- Found Contact --'        print '[+] User           : ' + str(row[0])        print '[+] Skype Username : ' + str(row[1])        if str(row[2]) != '' and str(row[2]) != 'None':            print '[+] Location       : ' + str(row[2]) + ',' + str(row[3])        if str(row[4]) != 'None':            print '[+] Mobile Number  : ' + str(row[4])        if str(row[5]) != 'None':            print '[+] Birthday       : ' + str(row[5])def printCallLog(skypeDB):    conn = sqlite3.connect(skypeDB)    c = conn.cursor()    c.execute("SELECT datetime(begin_timestamp,'unixepoch'), identity FROM calls, conversations WHERE calls.conv_dbid = conversations.id;")    print '
[*] -- Found Calls --'    for row in c:        print '[+] Time: ' + str(row[0]) + ' | Partner: ' + str(row[1])def printMessages(skypeDB):    conn = sqlite3.connect(skypeDB)    c = conn.cursor()    c.execute("SELECT datetime(timestamp,'unixepoch'), dialog_partner, author, body_xml FROM Messages;")    print '
[*] -- Found Messages --'    for row in c:        try:            if 'partlist' not in str(row[3]):                if str(row[1]) != str(row[2]):                    msgDirection = 'To ' + str(row[1]) + ': '                else:                    msgDirection = 'From ' + str(row[2]) + ' : '                print 'Time: ' + str(row[0]) + ' ' + msgDirection + str(row[3])        except:            passdef main():    parser = optparse.OptionParser("[*]Usage: python skype.py -p <skype profile path> ")    parser.add_option('-p', dest='pathName', type='string', help='specify skype profile path')    (options, args) = parser.parse_args()    pathName = options.pathName    if pathName == None:        print parser.usage        exit(0)    elif os.path.isdir(pathName) == False:        print '[!] Path Does Not Exist: ' + pathName        exit(0)    else:        skypeDB = os.path.join(pathName, 'main.db')        if os.path.isfile(skypeDB):            printProfile(skypeDB)            printContacts(skypeDB)            printCallLog(skypeDB)            printMessages(skypeDB)        else:            print '[!] Skype Database ' + 'does not exist: ' + skpeDBif __name__ == '__main__':    main()

<pre class="brush:php;toolbar:false;">#!/usr/bin/python#coding=utf-8import reimport optparseimport osimport sqlite3# 解析打印downloads.sqlite文件的内容，输出浏览器下载的相关信息def printDownloads(downloadDB):    conn = sqlite3.connect(downloadDB)    c = conn.cursor()    c.execute('SELECT name, source, datetime(endTime/1000000, 'unixepoch') FROM moz_downloads;')    print '
[*] --- Files Downloaded --- '    for row in c:        print '[+] File: ' + str(row[0]) + ' from source: ' + str(row[1]) + ' at: ' + str(row[2])# 解析打印cookies.sqlite文件的内容，输出cookie相关信息def printCookies(cookiesDB):    try:        conn = sqlite3.connect(cookiesDB)        c = conn.cursor()        c.execute('SELECT host, name, value FROM moz_cookies')        print '
[*] -- Found Cookies --'        for row in c:            host = str(row[0])            name = str(row[1])            value = str(row[2])            print '[+] Host: ' + host + ', Cookie: ' + name + ', Value: ' + value    except Exception, e:        if 'encrypted' in str(e):            print '
[*] Error reading your cookies database.'            print '[*] Upgrade your Python-Sqlite3 Library'# 解析打印places.sqlite文件的内容，输出历史记录def printHistory(placesDB):    try:        conn = sqlite3.connect(placesDB)        c = conn.cursor()        c.execute("select url, datetime(visit_date/1000000, 'unixepoch') from moz_places, moz_historyvisits where visit_count > 0 and moz_places.id==moz_historyvisits.place_id;")        print '
[*] -- Found History --'        for row in c:            url = str(row[0])            date = str(row[1])            print '[+] ' + date + ' - Visited: ' + url    except Exception, e:        if 'encrypted' in str(e):            print '
[*] Error reading your places database.'            print '[*] Upgrade your Python-Sqlite3 Library'            exit(0)# 解析打印places.sqlite文件的内容，输出百度的搜索记录def printBaidu(placesDB):    conn = sqlite3.connect(placesDB)    c = conn.cursor()    c.execute("select url, datetime(visit_date/1000000, 'unixepoch') from moz_places, moz_historyvisits where visit_count > 0 and moz_places.id==moz_historyvisits.place_id;")    print '
[*] -- Found Baidu --'    for row in c:        url = str(row[0])        date = str(row[1])        if 'baidu' in url.lower():            r = re.findall(r'wd=.*?&', url)            if r:                search=r[0].split('&')[0]                search=search.replace('wd=', '').replace('+', ' ')                print '[+] '+date+' - Searched For: ' + searchdef main():    parser = optparse.OptionParser("[*]Usage: firefoxParse.py -p <firefox profile path> ")    parser.add_option('-p', dest='pathName', type='string', help='specify skype profile path')    (options, args) = parser.parse_args()    pathName = options.pathName    if pathName == None:        print parser.usage        exit(0)    elif os.path.isdir(pathName) == False:        print '[!] Path Does Not Exist: ' + pathName        exit(0)    else:        downloadDB = os.path.join(pathName, 'downloads.sqlite')        if os.path.isfile(downloadDB):            printDownloads(downloadDB)        else:            print '[!] Downloads Db does not exist: '+downloadDB        cookiesDB = os.path.join(pathName, 'cookies.sqlite')        if os.path.isfile(cookiesDB):            pass            printCookies(cookiesDB)        else:            print '[!] Cookies Db does not exist:' + cookiesDB        placesDB = os.path.join(pathName, 'places.sqlite')        if os.path.isfile(placesDB):            printHistory(placesDB)            printBaidu(placesDB)        else:            print '[!] PlacesDb does not exist: ' + placesDBif __name__ == '__main__':    main()

<pre class="brush:php;toolbar:false;">#!/usr/bin/python#coding=utf-8import osimport sqlite3import optparsedef isMessageTable(iphoneDB):    try:        conn = sqlite3.connect(iphoneDB)        c = conn.cursor()        c.execute('SELECT tbl_name FROM sqlite_master WHERE type=="table";')        for row in c:            if 'message' in str(row):            return True    except:            return Falsedef printMessage(msgDB):    try:        conn = sqlite3.connect(msgDB)        c = conn.cursor()        c.execute('select datetime(date,'unixepoch'), address, text from message WHERE address>0;')        for row in c:            date = str(row[0])            addr = str(row[1])            text = row[2]            print '
[+] Date: '+date+', Addr: '+addr + ' Message: ' + text    except:        passdef main():    parser = optparse.OptionParser("[*]Usage: python iphoneParse.py -p <iPhone Backup Directory> ")    parser.add_option('-p', dest='pathName', type='string',help='specify skype profile path')    (options, args) = parser.parse_args()    pathName = options.pathName    if pathName == None:        print parser.usage        exit(0)    else:        dirList = os.listdir(pathName)        for fileName in dirList:            iphoneDB = os.path.join(pathName, fileName)            if isMessageTable(iphoneDB):                try:                    print '
[*] --- Found Messages ---'                    printMessage(iphoneDB)                except:                    passif __name__ == '__main__':    main()